Over on his YouTube channel, Simon has uploaded a video showing how while on holiday he was able to explore the various HD Radio stations available around the USA.
If you are in the USA, you might recognize HD Radio (aka NRSC-5) signals as the rectangular looking bars on the frequency spectrum that surround common broadcast FM radio signals. These signals only exist in the USA and they carry digital audio data which can be received by special HD Radio receivers. Earlier in 2017 a breakthrough in HD Radio decoding for SDRs like the RTL-SDR was achieved by Theori when he was able to piece together a full HD Radio software audio decoder that works in real-time. Nowadays you can use software like HDFM - HD Radio GUI to easily receive HD Radio with an RTL-SDR.
In his video Simon shows the various HD Radio signals he found while on holiday, and also shows some of their secondary features, including traffic data, and weather radar maps. Interestingly he also spots HD Radio in the AM bands, but finds his signal is not strong enough to decode.
The rest of the video explores other signals he finds such as a studio link, and TV audio signals.
I Found Some CRAZY Radio Technology while Traveling!
This post is about the KrakenSDR, one of our products from our sister company KrakenRF. If you weren't already aware, KrakenSDR is our 5-channel coherent radio based on RTL-SDRs, and it can be used for applications like radio direction finding. It can be purchased on Crowd Supply.
In this update we'd like to share some of the KrakenSDR projects we've been working on, as well as various projects we've seen from our customers.
Kraken Pro Cloud Online Mapper Updates
Recently we've been working hard at improving the 'Kraken Pro Cloud' online mapper service at map.krakenrf.com. If you were unaware, this service is an online mapping application that can be used together with one or more KrakenSDRs to display their generated bearings on a map. This is useful if you have multiple KrakenSDRs at fixed sites spread out over a wide area, as it allows you to instantly triangulate. The features include:
Multiple Kraken's displaying on a single map
Display a Heatmap just like the Android App
Ability to remote control the Kraken's individually, or all together from a single interface
Ability to share your Kraken with other users
Display log files collected from the Android App or Kraken Web GUI
Recently we've added multiple new features and improved several points:
Ability to plot multi-VFO (multi frequency) data coming from a KrakenSDR
Ability to put Kraken's into groups
Improved heatmap calculation and rendering speed
Fixed a memory leak that caused the mapper to crash after several hours
Improved the history feature (see further below)
Improved the interface
We'd like to especially highlight the improvements to the history feature. The history feature allows you to look back in time and see what the bearings and heatmap at that time looked like. This is useful if you are tracking something, but don't know exactly when the transmissions occur, or are tracking a moving object, and want to be able to review data at a later time.
Currently, we are supporting up to a week of free history, but this may change depending on how much history affects server load. For full disclosure, we eventually plan on making longer history recording available, but this will likely be a paid subscription feature. The timeframe of free history provided may change in the future too.
We also added the ability to play back history at faster speeds, kind of like a timelapse. To do this the heatmaps for each interval need to be precomputed first so that the playback is smooth, and so a 'precompute' button has been added.
We also want to note again that Kraken Pro Cloud is currently in beta, and there may still be some bugs. We also do not guarantee any uptime or privacy so please do not use the service for mission critical tasks. If you encounter bugs, please report them on our forums at https://forum.krakenrf.com, or via email to [email protected].
The gif animation below shows heatmap playback at 4x speed while the KrakenSDR was tracking the bearing towards a weather balloon.
Kraken Pro Cloud Mapper History Playback
KrakenSDR Core Updates
Since the last update we have made various bug fixes and a few minor changes to the core software. We highlight some changes below:
Our images have been updated to include SignalMedic's TAK server. (More on this in a section below)
(Beta feature) Added the ability to demodulate narrowband FM to audio files. This is in beta as the audio files don't come out particularly clean sounding, but it may be useful for some.
With the release of the Raspberry Pi 5, we have now also added a Raspberry Pi 5 ready-to-use image as well. The Raspberry Pi 5 runs the KrakenSDR software very smoothly and makes the GUI very responsive. Performance is similar to the Orange Pi 5. If are are new and choosing a platform to run the KrakenSDR on, we would highly recommend the Raspberry Pi 5 now.
Recently we have been working on getting an iOS version of the KrakenSDR app out. The app is close to completing development and should be out within about a month. Once released we will update our Wiki with links to the app, or you can simply search on the iOS app store for 'KrakenSDR'
KrakenSDR Crowdsupply Conference Workshop
One of the members of our team, Syed, recently ran a workshop on KrakenSDR. The workshop had attendees put together a KrakenSDR set on a large pizza pan and had teams go out into a local park to find a hand held radio transmitter. Photos of the day can be found here.
KrakenSDR Workshop at the Crowd Supply Conference
Highlights from Customers
KrakenSDR YouTube Tutorial from Skyler F
Over on YouTube user 'Skyler F' has uploaded a great video that demonstrates and shows how to set up KrakenSDR. In the video he demonstrates him finding some cellular phone towers.
Kraken Radio Direction Finding Unit Setup Tutorial and Demo
KrakenSDR Talk by KO4CEQ
We've also seen a great talk by KO4CEQ about KrakenSDR which has been uploaded to YouTube. In the talk he discusses KrakenSDR and shows his very neat car based setup.
PCARS March 2024 Mobile DF with KrakenSDR
Elektor Review of the KrakenSDR
Online store and magazine Elektor has uploaded to their blog a great review of the KrakenSDR. In the review they explain the KrakenSDR specs, and how it can be used as a regular SDR, and then go out to show how they created an antenna array and used the DoA software.
Elektor's Review of the KrakenSDR
Signal Medi's TAK Server
Thanks to 'SignalMedic' who had coded up a TAK server for KrakenSDR. TAK (Tactical Assault Kit) is software used by the military and other organizations for visualizing geospatial information such as enemy and friendly positions. Civilian versions of TAK also exist, such as ATAK for Android.
The TAK server allows for a KrakenSDR cursor to appear on a TAK map. TAK only allows for a single bearing line to show, so it's not as effective as our own mapping app, but this may be useful for customers who are only using TAK.
SignalMedic has made two implementations. One based on NodeRED, and the other based on Python. As mentioned previously, our image files now include the Python TAK server.
KrakenSDR TAK Server by SignalMedic
Aaron (aka cemaxcuter, aka creator of DragonOS) has also uploaded a video showing the TAK server in action.
WarDragon KrakenSDR to TAK Server w/ Node-RED (KrakenSDR)
Adrian's 3D Printed Antenna Spacer Arm
In the past we've highlighted Adrian's excellent 3D printed antenna spacer. The files for the 3D printed antenna spacer are available on Thingiverse.
Adrian has recently created a modified version of the arm that is significantly longer and should be able to cover 150 MHz to 1766 MHz. He also notes that he's updated the original arm to include files for laser cutting.
Dbvanhorn 3D Printed Antenna Spacer
We've also seen another 3D printed antenna spacer uploaded to Thingiverse. This file is based on OpenSCAD and allows you to customize the length to be printed.
Over the years we've posted several times about the TEMPEST applications of software-defined radio. TEMPEST aka (Van Eck Phreaking) is when you listen to the unintentional RF emissions of electronics and are able to recover information from that. In the past, we posted about TempestSDR, an RTL-SDR compatible program that allows you to view images from a computer monitor or TV simply by picking up the unintentional RF emissions from it.
Usually, the images received are fuzzy and it can be difficult to recover any information from them. However recently there has been work on combining Tempest techniques with deep learning AI for improving image quality.
Deep-tempest has recently been released on GitHub and from their demonstrations, the ability to recover the true image with deep learning is very impressive. From a fuzzy grey screen, they show how they were able to recover clear text which looks almost exactly like the original monitor image.
Deep-tempest is based on gr-tempest, and requires GNU Radio, Python 3.10 and a Conda environment. Instructions for installing it are on the GitHub.
The whitepaper on the University research done to implement Deep-Tempest can be found freely on arxiv at https://arxiv.org/pdf/2407.09717.
Last year the RFNM (RF Not Magic) software-defined radio was announced and opened up for pre-orders. RFNM is an SDR based on the new 12-bit LA9310 baseband processor chip, and together with either a 'Granita' or 'Lime' daughter board it is capable of tuning from 10 - 7200 MHz or 5 - 3500 MHz respectively. It is also capable of wide bandwidth - up to 153.6 MHz on a host device like a PC. The RFNM is affordable, costing US$299 for the motherboard, US$179 for the Lime board, and US$249 for the Granita board. Currently, the second production batch is available for preorder.
Recently we received our RFNM order, with both Granita and Lime boards. This is a review of our initial impressions and tests on it. Note that while the RFNM is capable of transmitting, in this review we did not test that capability.
Physical Review
The RFNM motherboard comes as a PCB with a large heatsink on the bottom and a very quiet inline fan. The daughterboards connect to the motherboard with a board-to-board connector and are secured in place via seven screws. There is another board-to-board connector for a second daughterboard to be connected, but in this review we did not test it.
On the right side there is a 4-18V DC barrel power jack and USB-A, USB-C, HDMI and Ethernet connectors. There is also a SIM card and SD card slot on the side. On the left of the board are MMCX connectors for external reference clock, and clock out. There are also various header pinouts for PPS OUT/IN, UART, I2C, GPIO and PWM. On the heatsink side there is a JTAG connector, jumpers for resetting the firmware, and pads to solder on an OCXO.
RFNM Motherboard and DaughterboardsRFNM bottom with heatsink, fan and rubber feet.
The device feels solid but there are a few exposed SMT components on the rear that have the potential to be knocked off with rough handling. All the main connectors are through-hole soldered and will not break off easily. During operation, the heatsink stays warm to the touch, and does not get too hot. The fan blades are exposed but should be safe from fingers and debris being on the bottom.
Initial Firmware Download
The device requires power from a 4 - 18V DC barrel jack and connects to a PC via a USB-C or USB-A port. According to the developer, it requires a 10-15W capable supply. In the tests below we used a 9V 2000mA switch mode supply, and a 12V 3000mA capable linear supply.
The device comes shipped without firmware, and the first setup step involves plugging in an internet-connected ethernet cable to automatically download and install the latest firmware. If you don't have an internet connected ethernet cable, an alternative is to plug in a USB stick with the latest firmware installed on it. The firmware installation took only a couple of minutes and went smoothly.
Initial Tests with SDR++
The easiest way to get something working with the RFNM is to use the custom SDR++ build included on the RFNM itself. When you plug in the RFNM it shows up on your PC as a disk drive, with an SDR++ folder. Getting started is as easy as running that SDR++ exe and clicking Play.
Initially, we encountered an issue where the RFNM wouldn't show up in SDR++, and wouldn't show up as a disk either. However, after flipping the USB-C connector it worked. This is an issue that continued throughout, and sometimes flipping wouldn't even work, but it always connected after a few reconnection attempts, and once the board was connected it was stable.
Lime Daughterboard Tests
We first tested the RFNM with the Lime daughter board. This is a board based on the Lime LMS7002 chip which is the same chip used in the LimeSDR. Here only the IQ output of the Lime chip is used, not the ADCs.
At this point, it's important to note that software support for the RFNM is still in the very early stages and SDR++ currently has no gain controls implemented. SDR++ is third-party software to RFNM so it's not any fault of the RFNM team. (NOTE: In the last few days after having already written this review, there have been several commits to SDR++ regarding RFNM, so this may already be resolved)
However, it is possible to SSH into the Linux OS system running on the RFNM system and change the gain setting through a bash command. To connect to SSH a network-connected ethernet cable needs to be connected to the board (alternatively you can use the UART port on the side of the board with an adapter). Once logged in via SSH we can browse to "/sys/kernel/rfnm_primary/rx0" and edit the value in the 'gain' text file. Then to activate the changes, simply set the value in the 'apply' text file to 1. This allowed us to optimize the gain settings for best reception.
cd /sys/kernel/rfnm_primary/rx0
echo 30 > gain && echo 1 > apply
RFNM with Lime daughterboard on the WiFi bandsRFNM with Lime daughterboard receiving mobile basestation signals.
With the ability to set the gain, the Lime board works great. Signals are strong in the VHF and UHF bands where sensitivity is approximately -135 dBm, and there is little sign of imaging with appropriate gain settings. In the 2.4 GHz band, the sensitivity remains good at around -130 dBm too. Although the advertised max frequency range is 3500 MHz, we were able to receive up to about 3.85 GHz with reduced sensitivity.
On HF, however, the Lime board performs very poorly. We start to see a drop off at around 50 MHz where the sensitivity is roughly -93 dBm, at 30 MHz about -58 dBm, and 15 MHz about -37 dBm.
Granita Daughterboard Tests
In the second test, we removed the Lime board from the RFNM motherboard and installed the Granita daughterboard. The Granita daughterboard is based on an Arctic Semiconductor 'Granita' chip, an RFFC2071A mixer, and several preselectors.
Unfortunately, we are very disappointed in the performance of Granita as there is very significant imaging of signals, and this wipes out the ability to cleanly receive almost every band. According to Davide, this problem is a firmware issue with the Arctic Semiconductor Granita chip that can maybe be fixed in the future, but there is no guarantee that it is fixable, as any fix is at the mercy of the Arctic Semiconductor, who don't seem to be very responsive to the issue. Davide (creator of the RFNM) writes:
In the Lime board, the IQ LPF works properly. For granita, it doesn’t work at all, like the -3 dB point of the 20 MHz LPF option is 100 MHz+. The manufacturer of the RFIC kept saying that this is a firmware bug, so I gave them a devkit to replicate, but they never fixed it over the last month. I don’t know at this point if this is a software problem or if they discovered it’s something more.
We confirmed that adjusting the gain settings on Granita did not help with the imaging problem either.
Heavy imaging was experienced with Granita (compare this to the true WiFi spectrum shown previously with the Lime board).
We also noticed that Granita was picking up or internally generating significant noise spikes. We initially assumed this was from the 9V SMPS, but even with a 12V linear power supply similar spikes were seen. The same noise was not visible with the Lime board.
Granita unknown noise spikes
Sensitivity in the bands above 600 MHz was good, at around -135 dBm. Below 600 MHz where the mixer is used, sensitivity was a bit poorer at around -123 dBm. The highest frequency we could receive was around 5900, but after about 5 GHz signals started to become very weak. The Granita board is advertised as receiving 10 - 6300 MHz, however, the documentation notes that the current batch is only capable of tuning to around 5 GHz. They note that the next batch should reach 6.3 GHz.
The Granita board was able to receive broadcast AM, shortwave, and ham frequencies with good signal strength. At 15 - 50 MHz the sensitivity is roughly -115 dBm.
Granita receiving the 0 - 15 MHz.
At the time of this review, we cannot recommend that anyone purchase the Granita board unless they are working in a very controlled environment. We hope that in the near future the IQ LPF problem can be fixed to make the Granita board usable.
GNU Radio Tests (Windows)
The file drive on the RFNM also comes with a Soapy driver available. We copied the RFNMSupport.dll file from the RFNM drive over to our GNU Radio radioconda installation's SoapySDR folder at C:\Users\proje\radioconda\Library\lib\SoapySDR\modules0.8. Then we opened GNU Radio and opened the gnuradio_example.grc file. This brings up a FFT and waterfall display like in SDR++ and with the Gain controls exposed. With the gain controls exposed the Lime + RFNM combination works great.
The daughterboards also have built-in antennas that can be switched in or out using a drop down box in the GNU Radio UI. The built-in antenna on both boards is a Pulse W3796 which has an advertised range of 698 MHz to 2.7 GHz. While the built-in antenna works well for nearby bench reception, we preferred to still use our outdoor dipole antenna for better reception.
153.6 MHz Bandwidth Mode
It's possible to set the RFNM to provide even more bandwidth by connecting two USB cables to the PC. That gives us up to 153.6 MHz of 12-bit data. Enabling this mode requires editing a variable via the terminal
Once this was set we were able to edit the samp_rate block in the GNU Radio example, and set it to 153.6 MHz. At the moment the current SDR++ does not support the 153.6 MHz sample rate.
RFNM Running 153.6MHz in GNU Radio.
Conclusion
It's clear that the RFNM is cutting edge, yet affordable, and has great potential and excellent features and specifications. The built-in processor, DSP and GPU capabilities on the RFNM could be game changers in the near future. However, at the time of this review, the software support is still in its very early stages, documentation is lacking, and it's not yet recommended for mainstream users who just want to plug in and get started with an SDR for listening and decoding signals.
Regarding the Granita daughterboard, we would probably hold off on purchasing this until there is some clarification on the IQ LPF fix.
If you are an advanced SDR user who is comfortable with GNU Radio, Linux and advanced applications like setting up and running mobile basestations, then the RFNM may be a good choice. We are looking forward to applications that make use of the onboard DSP and GPU capabilities.
Over on his blog Jeff Sandberg has posted a writeup detailing how he combined RTL-SDR, rtl_amr, and HomeAssistant to decode wireless data from his Itron power meter, and create useful graphs showing his US home's power usage.
In the post, Jeff explains how he uses an RTL-SDR Blog V4, HomeAssistant, EMQX, and rtl_amr to receive and plot the data. The RTL-SDR and rtl_amr software receives and decodes the wireless Itron electricity meter data packets, and then EQTT passes the data to HomeAssistant for logging and plotting. Jeff also notes how he used NodeRed to correctly automate the summer and winter tariff price changes.
Finally, in an update to the post Jeff mentions that he was also able to receive and log data from his gas meter.
HomeAssistant energy dashboard with data received from an RTL-SDR and rtl_amr decoder.
Over on YouTube Paul Lutus has recently posted a video that is a great introduction to software-defined radio, RTL-SDR, and some of the various signals that can be received with one. In the video he uses an RTL-SDR Blog V4, which has a built-in upconverter, allowing for good reception of HF signals.
Paul's video briefly explores SDR theory, before demonstrating various signals on both the HF and VHF+UHF bands that can be received with an RTL-SDR Blog V4. He also briefly touches on GNU Radio.
If you are a just getting started with RTL-SDR this might be a good overview video to watch. Paul has also set up a companion webpage for the video that outlines some of the software installation and usage steps mentioned in the video in greater detail.
Create Your Own Open-Source Software-Defined Radio
Over on her YouTube channel SignalsEverywhere, Sarah has uploaded her latest video showing how it is possible to monitor Itron ERT smart meters on an Android device. Smart meters are used to wirelessly monitor the usage of residential utilities such as water, gas, and electricity. With an RTL-SDR and some decoding software, it is possible to monitor the data coming from your own and your neighbours meters (at least for certain brands of meter).
In her video, Sarah shows how she compiled the rtl_amr decoder software for Android, and created her own Android app called "AndAMR" for displaying the data decoded by rtl_amr. The rest of the video shows how to set up and use the app.
In his latest video, Matt from the TechMinds YouTube channel tests out an LHCP L-band helix feed designed for receiving Inmarsat satellites. Matt pairs the feed with an 85cm satellite dish, an L-band LNA, and an Airspy Mini.
The L-band helix feed comes from a small German engineering company called nolle.engineering. The feed is priced at 94.70 Euros (incl. VAT) (~$102 USD), plus shipping costs. It is a passive antenna so it needs to be combined with an LNA to be usable with a typical SDR.
In the video Matt shows that the reception with the LHCP helix + dish setup is better than expected. He also compares it to a previous test he did with a longer RHCP helix antenna also produced by nolle.engineering. The RHCP antenna is used to be used without a dish, however, as expected the SNR is less than the dish + small LHCP feed setup. Matt then shows some Inmarsat signals being decoded including STD-C and Aero voice.
This L Band Helix Antenna Gives Amazing Performance